bemgroup.ir - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 168.119.88.148, located in Germany and belongs to HETZNER-AS, DE. The main domain is bemgroup.ir.
TLS certificate: Issued by R3 on April 3rd 2022. Valid for: 3 months.

This is the only time bemgroup.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	168.119.88.148 168.119.88.148	24940 (HETZNER-AS) (HETZNER-AS)
5	51.77.78.57 51.77.78.57	16276 (OVH) (OVH)
1	2606:4700:303... 2606:4700:3035::ac43:c763	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	3

1 168.119.88.148 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: res6.abtinweb.com

bemgroup.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 51.77.78.57 (France)

ASN16276 (OVH, FR)
PTR: ip57.ip-51-77-78.eu

wdym.authorizeddns.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:c763 (United States)

ASN13335 (CLOUDFLARENET, US)

js-codes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	authorizeddns.net wdym.authorizeddns.net	332 KB
1	js-codes.com js-codes.com	2 KB
1	bemgroup.ir bemgroup.ir	9 KB
7	3

	Domain	Requested by
5	wdym.authorizeddns.net	bemgroup.ir wdym.authorizeddns.net
1	js-codes.com	bemgroup.ir
1	bemgroup.ir
7	3

This site contains no links.

Subject Issuer	Validity	Valid
*.bemgroup.ir R3	`2022-04-03` - `2022-07-02`	3 months	crt.sh
wdym.authorizeddns.net R3	`2022-06-10` - `2022-09-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://bemgroup.ir/2022.php?page=login&case_id=mhe64vd286kaw98
Frame ID: FF8CBDFF72E6611E3D4186484D85DDE4
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in - chase.com

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

344 kB
Transfer

416 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 2022.php Show response
bemgroup.ir/ 9 KB
9 KB 161ms
96ms Document
text/html 168.119.88.148
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bemgroup.ir/2022.php?page=login&case_id=mhe64vd286kaw98

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

168.119.88.148 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

res6.abtinweb.com

Software

Apache /

Resource Hash

edfe5e82b5de9181747ac5c27b748140eb9404610acd84bef51c479c47c64fdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 17 Jun 2022 01:22:41 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff

GET
H2 200 signin.php
wdym.authorizeddns.net/assetschase//css/ 18 KB
4 KB 50ms
9ms Stylesheet
text/css 51.77.78.57
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://wdym.authorizeddns.net/assetschase//css/signin.php
Requested by: Host: bemgroup.ir
URL: https://bemgroup.ir/2022.php?page=login&case_id=mhe64vd286kaw98
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.77.78.57 , France, ASN16276 (OVH, FR),
Reverse DNS: ip57.ip-51-77-78.eu
Software: LiteSpeed /
Resource Hash: dd9920cd4e0b11fd203ebf0c480d9e26b37645e316ee2e2e1caf445db8e63229

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bemgroup.ir/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
content-encoding: gzip
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css; charset: UTF-8;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 3711
expires: Fri, 24 Jun 2022 01:22:42 GMT

GET
H2 200 modernizr.min.js Show response
js-codes.com/modernizr/2.9.1/ 4 KB
2 KB 77ms
22ms Script
application/javascript 2606:4700:3035::ac43:c763
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-codes.com/modernizr/2.9.1/modernizr.min.js
Requested by: Host: bemgroup.ir
URL: https://bemgroup.ir/2022.php?page=login&case_id=mhe64vd286kaw98
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express, Phusion Passenger(R) 6.0.10
Resource Hash: a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bemgroup.ir/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 8455
x-powered-by: Express, Phusion Passenger(R) 6.0.10
status: 200 OK
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 11 Oct 2017 07:04:24 GMT
server: cloudflare
etag: W/"edf-15f0a3fa4c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RdmCcug4iE5T8VKvtRWDirF8ttNLbFLHdLeYmf2a70QBfvM%2FsWkjkBtp7CeCMXwqft3hR9V2UJRl%2Fur0TYxCHcPKQrdOXicrEosUMtXzENYs0Ysad00GINADYgUwDJFvr%2FR5JXZ6AD4IwTk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
cf-ray: 71c7f9c53d213750-MXP
expires: Fri, 16 Jun 2023 23:01:47 GMT

GET
H2 200 jquery-3.3.1.min.js Show response
wdym.authorizeddns.net/assetschase//js/ 85 KB
29 KB 9ms
9ms Script
application/x-javascript 51.77.78.57
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://wdym.authorizeddns.net/assetschase//js/jquery-3.3.1.min.js
Requested by: Host: bemgroup.ir
URL: https://bemgroup.ir/2022.php?page=login&case_id=mhe64vd286kaw98
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.77.78.57 , France, ASN16276 (OVH, FR),
Reverse DNS: ip57.ip-51-77-78.eu
Software: LiteSpeed /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bemgroup.ir/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
content-encoding: br
last-modified: Sat, 18 Dec 2021 09:41:54 GMT
server: LiteSpeed
etag: "1538f-61bdace2-1020a5;br"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 29523
expires: Fri, 24 Jun 2022 01:22:42 GMT

GET
H3 200 white_logo.svg
wdym.authorizeddns.net/assetschase/images/ 1 KB
937 B 8ms
8ms Image
image/svg+xml 51.77.78.57
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wdym.authorizeddns.net/assetschase/images/white_logo.svg
Requested by: Host: wdym.authorizeddns.net
URL: https://wdym.authorizeddns.net/assetschase//css/signin.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 51.77.78.57 , France, ASN16276 (OVH, FR),
Reverse DNS: ip57.ip-51-77-78.eu
Software: LiteSpeed /
Resource Hash: d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wdym.authorizeddns.net/assetschase//css/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
content-encoding: br
last-modified: Tue, 21 Aug 2018 12:07:24 GMT
server: LiteSpeed
etag: "581-5b7c007c-1020a0;br"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 630
expires: Fri, 24 Jun 2022 01:22:42 GMT

GET
H3 200 background.desktop.night.1.jpeg
wdym.authorizeddns.net/assetschase/images/ 245 KB
245 KB 9ms
9ms Image
image/jpeg 51.77.78.57
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wdym.authorizeddns.net/assetschase/images/background.desktop.night.1.jpeg
Requested by: Host: wdym.authorizeddns.net
URL: https://wdym.authorizeddns.net/assetschase//css/signin.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 51.77.78.57 , France, ASN16276 (OVH, FR),
Reverse DNS: ip57.ip-51-77-78.eu
Software: LiteSpeed /
Resource Hash: 38e6598d39689b79c8b1d3ee5f56288db872835c66b19abe44056a13e34c8c64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wdym.authorizeddns.net/assetschase//css/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
last-modified: Wed, 13 Apr 2022 08:43:46 GMT
server: LiteSpeed
etag: "3d3f5-62568d42-10207e;;;"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 250869
expires: Fri, 24 Jun 2022 01:22:42 GMT

GET
H3 200 lighter_font.woff
wdym.authorizeddns.net/assetschase/fonts/ 53 KB
53 KB 26ms
9ms Font
application/font-woff 51.77.78.57
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://wdym.authorizeddns.net/assetschase/fonts/lighter_font.woff
Requested by: Host: wdym.authorizeddns.net
URL: https://wdym.authorizeddns.net/assetschase//css/signin.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 51.77.78.57 , France, ASN16276 (OVH, FR),
Reverse DNS: ip57.ip-51-77-78.eu
Software: LiteSpeed /
Resource Hash: 7edd9d10f14856ef55eb7a3dd9f671f6f0afd4c64900cc8d5d6b80d2cdbe1977

Request headers

Referer: https://wdym.authorizeddns.net/assetschase//css/signin.php
Origin: https://bemgroup.ir
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 01:22:42 GMT
last-modified: Tue, 21 Aug 2018 12:12:26 GMT
server: LiteSpeed
etag: "d448-5b7c01aa-102075;;;"
content-type: application/font-woff
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 54344

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bemgroup.ir
js-codes.com
wdym.authorizeddns.net
168.119.88.148
2606:4700:3035::ac43:c763
51.77.78.57
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
38e6598d39689b79c8b1d3ee5f56288db872835c66b19abe44056a13e34c8c64
7edd9d10f14856ef55eb7a3dd9f671f6f0afd4c64900cc8d5d6b80d2cdbe1977
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
dd9920cd4e0b11fd203ebf0c480d9e26b37645e316ee2e2e1caf445db8e63229
edfe5e82b5de9181747ac5c27b748140eb9404610acd84bef51c479c47c64fdb

bemgroup.ir Open in urlscan Pro 168.119.88.148 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

344 kBTransfer

416 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

bemgroup.ir Open in urlscan Pro
168.119.88.148 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

344 kB
Transfer

416 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!